Norman Malware Cleaner 2.1

Needs no installation. Works in Safe Mode. Good malware detection. Especially effective against scareware in testing.

Cons
Lengthy scan. Rootkit cleanup and sandbox-based detection not enabled by default. Left many detected threats running after supposed cleanup. Especially poor against rootkits in testing. No real-time protection.

Bottom Line

Both PCMag's tests and independent lab tests show that Norman's malware cleanup isn't the best. However, this free tool runs even when malware blocks installation of more full-featured products. Give it a try when you need a quick fix.

Doesn't Remove All Detected Threats
Like Malwarebytes' Anti-Malware 1.46 (Free, 3.5 stars) and Norton Power Eraser (Free, 4 stars), Norman needs no installation. It just gets right to the business of cleanup. The stark main tab lets you choose Quick, Normal, Full or Custom scan. Other tabs show scan progress, options, quarantined files, and program version info. That's it.

On examining the options tab I noticed that rootkit cleanup isn't enabled by default. My Norman contacts explained that if the product detects a rootkit it will recommend scanning again with that feature enabled. I enabled it before scanning my test systems.

Norman's sandbox-based detection analyzes suspect programs to detect zero-day and polymorphic viruses. This feature is also disabled by default, as using it lengthens the scan time. I turned it on for testing.

With rootkit cleaning and sandbox detection turned on, a full scan took about 40 minutes. That's definitely longer than Norton Power Eraser's super-quick scan, but still not too bad. G Data AntiVirus 2012 ($29.95 direct, 3.5 stars), Panda Antivirus Pro 2012 ($49.99/year direct for three licenses, 3 stars), and ZoneAlarm Antivirus + Firewall 2012 ($59.95 direct for three licenses, 3 stars) all run much faster after the initial scan. Norman doesn't; a repeat scan took just as long.

At the end of the scan Norman simply reports what it found and what action it took. The user doesn't have to make any decisions. On seven of the infected test systems, I honored its request to reboot the system and scan again.

Norman detected 85 percent of the threats, the same as Panda. That's the best detection rate so far with my latest set of malware samples. However, despite having "cleaner" in its name it didn't clean up the found threats thoroughly. Over a quarter of the detected threats were still running after Norman's alleged cleanup, and it left behind executable traces for nearly another quarter.

Norman scored 5.3 points for overall cleanup, edging out G Data's 5.4 to become the lowest score with my current malware collection. Looking specifically at scareware (rogue security software), though, it scored quite a bit better. Norman detected all of the scareware samples and scored 9.5 points, tying with Panda for the best scareware removal.

However, even though I actively turned on rootkit removal, Norman totally bombed against rootkits. All but one of those it detected were still running after Norman supposedly removed them. It scored just 2.4 points for rootkit removal. Norton Power Eraser, tested against my previous set of rootkits, detected them all and scored 6.0 points.

Still a Useful Tool
My hands-on tests and the independent lab tests both indicate that Norman's cleanup isn't perfect. Even so, it's still a useful tool. Don't literally add it to your toolbox, though. Norman updates the product every day, in lieu of requiring signature updates. Download when you need it for a quick fix. If it doesn't do the job completely, give Norton Power Eraser a whirl, or Malwarebytes. All three are free, so you're free to experiment.

Automatic Renewal Program: Your subscription will continue without interruption for as long as you wish, unless
you instruct us otherwise. Your subscription will automatically renew at the end of the term unless you authorize
cancellation. Each year, you'll receive a notice and you authorize that your credit/debit card will be charged the
annual subscription rate(s). You may cancel at any time during your subscription and receive a full refund on all
unsent issues. If your credit/debit card or other billing method can not be charged, we will bill you directly instead. Contact Customer Service